Skip to main content
11 votes
Accepted

How can I determine if a piece of code is an encryption algorithm?

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
NirIzr's user avatar
  • 11.8k
11 votes

ZTE encrypted backup config file

Updated for August 2020: The below information is accurate to the best of my knowledge. It has been used to decrypt config.bin on 2 different routers at the time of writing. The obfuscated section ...
mkst's user avatar
  • 266
11 votes
Accepted

How do Enigma, Themida and VMProtect compare to each other?

Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research. This comparison will only include the protectors ...
3dsboy08's user avatar
  • 226
9 votes

Question about Keeloq - A car remote control standard

To create a full duplicate, able to generate valid transmission packets you'll need the following information: Serial Number Button press mapping 32 bit of KeeLoq encrypted data See attached Figure ...
NirIzr's user avatar
  • 11.8k
8 votes
Accepted

Finding the encryption key in a binary - IDA Pro and how an S-box might be represented in the binary

Initialization of the forward S-box As you probably saw in the source-code, the forward S-box is present several times and initialized at two different places. The first time that the forward S-box ...
Megabeets's user avatar
  • 8,999
6 votes

Decoding New Jersey Driver's License Codes

In case you're still trying to figure this out, I've made some progress. With assistance from u/jccool5000 on reddit (post), who has a collection of over 900 samples mostly from Ontario. AFAIK, ...
boat's user avatar
  • 61
6 votes
Accepted

Is there a way to find out which hash standard by studying the source code?

This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented. You wanted to know how to approach such a task so I'll explain what I did. Typically, when trying ...
Johann Aydinbas's user avatar
6 votes
Accepted

How can I identify how this string is being encoded so I can replicate it?

Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer) The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform ...
Megabeets's user avatar
  • 8,999
6 votes
Accepted

McDonald's receipt codes

As suggested in a comment, the final character is indeed a check digit. It appears to be calculated using the Luhn algorithm with 25 as the base instead of 10. Using the code in photo as an example: ...
user7290573's user avatar
5 votes
Accepted

How to get file back from generated sha256 checksum?

This is actually one of the main attributes of Cryptographic Hash Functions. As mentioned in the wiki page, they are designed so they cannot be reversed: It is infeasible to generate a message from ...
NirIzr's user avatar
  • 11.8k
5 votes

Decoding New Jersey Driver's License Codes

I don't see this above, but male or female is coded in as well. in the last five digits, the first 2 are month of birth. Males are 01-12. Females 50 is added. so the run from 51 (january) to 62 (...
alexandra's user avatar
5 votes
Accepted

Having keys and binary, how do I reverse/decrypt a stream encryption?

Good news, You're lucky! What you're facing in front of you is a stream cipher. Why is that good? because the way stream ciphers are built makes them extremely easy to reverse - the decryption and ...
NirIzr's user avatar
  • 11.8k
5 votes

Identification of AES portion code in binary

The best way to locate AES in a binary blob would be to locate first the AES S-box. It is specifically designed for AES and recommended by the NIST, so a standard AES must include it. Moreover, they ...
perror's user avatar
  • 19.1k
4 votes
Accepted

Help deciphering binary that creates 3 passwords

Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this: char input_file_buffer[...
Guntram Blohm's user avatar
4 votes

How can I identify how this string is being encoded so I can replicate it?

Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this: perl -lne 'print reverse($_) ^ ("\x04" x ...
Ilmari Karonen's user avatar
4 votes
Accepted

TP-Link encrypted backup file TX-VG1530

It seems they also added compression there. This utility seems to decode it: https://www.nirsoft.net/utils/router_password_recovery.html Also, I'd just written my own decoder and encoder for it: https:...
Shelwien's user avatar
  • 156
4 votes

Decrypting SQLite Database with key

There exists an official encryption addon for SQLite but from your description it sounds more like the data is simply stored encrypted in the blobs and the application decrypts it internally before ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes

ZTE encrypted backup config file

came across these keys and sharing Known AES keys: zxhn h118n ert5 - 'MIK@0STzKpB%qJZe' zxhn h118n V2.1.3_ROSCNT? - 'MIK@0STzKpB%qJZf' zxhn h168n v3 ...
user33502's user avatar
3 votes

How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?

There's not much information to go on, but I would probably try to proceed like this: Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes
Accepted

how can i Encrypt a decrypted zte zxhn h108n V2.5 config file?

You can use the zcu module to do this. python examples/encode.py config.bin.xml out.bin --key 'GrWM2Hz&LTvz&f^5' --signature 'ZXHN H108N V2.5' Full disclosure: I wrote the zcu module. It's ...
mkst's user avatar
  • 266
3 votes
Accepted

Strings weirdly split in binary

Shot in the dark: Maybe this text (or the whole binary image) is compressed. Think something like LZSS. The fact that there is a mystery byte containing eight 1 bits, followed by eight literal and ...
smitelli's user avatar
  • 258
3 votes
Accepted

Way to know if firmware is compressed

I believe it is not compressed or encrypted. Entropy of 0.8 is pretty poor for any decent encryption or compression. These regions are more likely to be code. With this in mind, let's look at a ...
Ian Cook's user avatar
  • 2,548
3 votes

RE Huawei HG8145V5 user credentials

It's probably AES. I saw config files at HG8245Hv5 and HG8245H5 and passwords are looking similar. A bit (just a bit:D) more info is here: https://the-infosec.com/2017/03/20/huawei-hg8245h-router-...
HE9CbITb's user avatar
  • 101
3 votes
Accepted

How can I retrieve the encryption key in this code?

The encryption key is stored in the variable f4800b. It comes out to the following byte array. 43, 57, 97, -68, -63, -61, -40, 9, 50, 87, -104, 101, 63, 34, -78, 60 The cipher algorithm used is ...
0xec's user avatar
  • 6,090
3 votes

Need help with ZTE router config.bin file decryption and encryption

You can use the zcu module (written by Mark Streetster) to decrypt/encrypt your config.bin file.
user2017's user avatar
3 votes

Find Decryption algorithm of an encryption algorithm

Non-Invertibility (1) It's definitely not invertible. To see this you only need to consider the contents of tmp1 after 2 iterations of the first loop. Let's unroll these 2 iterations (and, for ...
Ian Cook's user avatar
  • 2,548
3 votes
Accepted

How can I decrypte the data in this SQLite Database file

You can open that file using SQLiteStudio to get that information. Steps: Download SQLiteStudio and install it Drag the file (Strong.isa_lex) onto the left sidebar in SQLiteStudio and click OK Double-...
Steve's user avatar
  • 66
3 votes

Decrypt the cookies stored by the MS Teams desktop client

Just so you know, I think this has already been done - https://github.com/sleuthkit/autopsy_addon_modules/tree/master/IngestModules/Microsoft_Teams_Parser You could just browse the code at https://...
Mega Tonnage's user avatar
3 votes

How can I extract the password from an installer/self-extracting archive?

Well, you need to analyze the installer for the password. This usually involves decompiling. Static analysis is a good place to start. You may find the password stored as a string in the installer or ...
Nick's user avatar
  • 31
2 votes

Driver's Licence Last Name Numbering Format (Ontario, Quebec, New Jersey)?

I know this is an old thread and probably you either figured it out on your own or gave up and dgaf anymore. But this is I believe Soundex code (It absolutely is the case for the Quebec drivers ...
John's user avatar
  • 31

Only top scored, non community-wiki answers of a minimum length are eligible